Office at risk from bug trio

A trio of what appear to be new, yet-to-be-patched flaws in Microsoft Office has surfaced, according to security researchers at McAfee.

The vulnerabilities were reported in online security forums on Monday, according to a posting on the McAfee Avert Labs blog. All but one of the flaws results in denial of service, meaning the application would crash, according to the blog post.

Security from A to Z

Click on the links below to find out more...

A is for Antivirus
B is for Botnets
C is for CMA
D is for DDoS
E is for Extradition
F is for Federated identity
G is for Google
H is for Hackers
I is for IM
J is for Jaschan (Sven)
K is for Kids
L is for Love Bug
M is for Microsoft
N is for Neologisms
O is for Orange
P is for Passwords
Q is for Questions
R is for Rootkits
S is for Spyware
T is for Two-factor authentication
U is for USB sticks/devices
V is for Virus variants
W is for Wi-fi
X is for OS X
Y is for You
Z is for Zero-day

Karthik Raman, a McAfee researcher wrote on the blog: "There is one heap-overflow flaw that might be exploited for code execution." Typically such flaws are exploited by tricking a targeted victim into opening a rigged Office document.

Microsoft is investigating the bug reports as well, a company representative said. The software behemoth is not aware of any attacks that exploit any of the issues at this time, the representative added.

Word of the flaws comes on the day Microsoft issued five security bulletins as part of its monthly patch cycle. It is still dealing with the aftermath of an emergency patch released last week

Raman wrote: "This is yet another time that zero-day flaws have been published around a Patch Tuesday, possibly to maximise the exposure to these flaws until the next month's Patch Tuesday."

Cyber crooks have found they can take advantage of Microsoft's security update cycle by timing new attacks right before or just after Patch Tuesday - the second Tuesday of each month when the software maker releases its fixes. Some security watchers have coined the term "zero-day Wednesday" to describe that strategy.

McAfee is still investigating the security vulnerabilities. They may not actually all be new, said Dave Marcus, security research and communications manager at the company. "Sometimes what people claim to be zero-days may in fact be related to something that's already known," he said.

Should the three Office bugs be new, the tally of zero-day vulnerabilities in the productivity suite waiting for a fix would jump to five. Microsoft did not deliver any patches for Office on Tuesday, despite two vulnerabilities in the software that have been previously disclosed, according to eEye Security's zero-day flaw tracker.

Redmond issued five security bulletins with fixes for eight flaws on Patch Tuesday, including a "critical" zero-day vulnerability in Windows which also affects Vista.

Joris Evers writes for CNET News.com